Exact Extract: “MITRE ATT & CK classifies and describes cyberattacks and intrusions through 14 tactics… These categories are further broken down into specific techniques and subtechniques.”
Exact Extract: “The attacker then performs active reconnaissance using a mix of techniques, including port scanning and IP discovery, to find high-priority targets.”
The correct answers are A and D. The infected host first collected its own network configuration and connection details. That maps to System Network Connections Discovery, because MITRE defines this technique as attempting to list network connections to or from the compromised system. The later behavior—sending low-volume connection attempts to multiple internal addresses to identify responding hosts—maps best to Active Scanning, because MITRE describes active scanning as probing victim infrastructure through network traffic.
Network Sniffing is wrong because the scenario does not describe passive packet capture or monitoring traffic on an interface. Lateral Movement is also wrong because it is a MITRE tactic, not the best technique for host discovery activity. The host is still discovering reachable systems; it has not yet moved to another internal system.
Technical Deep Dive: In a Fortinet SOC investigation, this sequence is a classic post-compromise discovery pattern. Commands such as ipconfig, route print, netstat, Get-NetTCPConnection, or arp -a support System Network Connections Discovery. Low-rate probes to many internal IPs are often stealthier than noisy scans and may appear as sparse FortiGate traffic logs, Windows firewall events, or EDR telemetry. FortiSIEM should correlate this with source host, destination spread, port diversity, and time window. FortiGate NP/CP chips may accelerate allowed sessions, but detection occurs in FortiSIEM from logs and metadata, not inside the ASIC forwarding path.
